mutually recursive discharge macaroons cause infinite recursion

[rogpeppe]

The following code causes a RuntimeError exception to be raised due to infinite recursion:

import pymacaroons
import base64

m1 = pymacaroons.Macaroon(location="", identifier="root-id", key="root-key")
m1.add_third_party_caveat("bob",  "bob-caveat-root-key", "bob-is-great")
m2 = pymacaroons.Macaroon(location="bob", identifier="bob-is-great", key="bob-caveat-root-key")
m2.add_third_party_caveat("charlie", "bob-caveat-root-key", "bob-is-great")
m2 = m1.prepare_for_request(m2)
pymacaroons.Verifier().verify(m1, "root-key", [m2])

An attacker could use this as a denial-of-service attack.

[ecordell]

Thanks for noticing this! This is definitely a major problem (assuming separate parties are issue the root/discharge macaroons).

How does libmacaroons handle this case? Disallow cycles or allow them but detect them and move on?

[rogpeppe]

Both libmacaroons and my Go macaroons package fail gracefully on cycles. libmacaroons makes sure that the number of used macaroons doesn't exceed the provided number of discharges. The Go macaroon package ensures that the use count of every discharge macaroon is exactly one (and fails immediately if the count goes above one).

See also rescrv/libmacaroons#48 (comment)